GCP-2026-043

Summary

A flaw in the GetSignedGcsUrl RPC of Firebase Studio let authenticated users list buckets and download deployment source code belonging to other tenants. The issue is tracked as CVE-2026-12715 with High severity and was published on 2026-06-24.

Mitigation

No action is required to mitigate this vulnerability as the fix has been deployed to the backend service. As a precaution, users who stored sensitive information, such as API keys (for example, GEMINI_API_KEY), within their Firebase Studio workspace may choose to rotate these keys. For instructions, see the Firebase Studio troubleshooting guide.

Related items

• MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
• HighCVE-2026-117560: ATXP Gemini CLI extension OS command injection in runAtxp() via MCP parametersSame vendor · NVD/CVE Database
• CriticalCVE-2026-90970: GitLab AI Gateway prompt template sandbox escape via crafted flow configurationSame vendor · NVD/CVE Database
• MediumCVE-2026-89278: GPTranslate WordPress plugin exposes plaintext API key to unauthenticated usersSame vendor · NVD/CVE Database
• CriticalCVE-2026-19407: Google Cloud Gemini Enterprise Agent Platform SDK for Python bucket squattingSame vendor · NVD/CVE Database